[Mimedefang] Sexyfun.net

Michael D. Sofka sofkam at rpi.edu
Wed Mar 13 09:46:16 EST 2002


At 12:40 PM 3/13/2002 +1000, Tony Nugent wrote:
>On Mon Mar 11 2002 at 10:30, "J.P van Oyen" wrote:
>
>> This is the final entry I have.
>> 
>>      #-------------------------------------------------------------------
>>      # Get rid of the hahaha at sexyfun.net to avoid bounces on <> address
>>      #-------------------------------------------------------------------
>>      if ($lc_fname eq 'joke.exe' || $lc_fname eq 'sexy virgin.scr' ||
>> $lc_fname eq 'midget.scr'){
>>          return action_bounce("The attachment $lc_fname contains a virus:
>> [W32/Hybris.gen\@MM virus]");
>>      }
>
>One of the problems with email generated by the hybris MM virus is
>that it progagates itself with an invalid sender address (null).
>The returned email will bounce.
>
>Better to drop these altogether (or let them through to the intended
>recipient with the infected attachment removed).

I just use action_discard on viruses, and check that the sender is
not "<>" before sending a notification.  There is usually no real content
to a virus, and the recipient would just be annoyed by hundreds of
"virus was removed" messages.   Even if it where a virus that attached
to valid mail, delivering the valid part removes an incentive for the sender
to fix his or her machine.

I gave up on action_bounce.  Bouncing a virus often causes
a resend (it shouldn't, but it does).  I may even drop the notification
since a high proportion of them bounce, or cannot be delivered because
the account is full.

(One of these day's I'll install MySQL and record who notices are sent
to, so I can try one notification.  And, if the same sender/relay keeps trying
block them at a higher level to save the MIMEDefang overhead.)

>And yes I agree, this virus is a PITA, it just won't go away.

No kidding.  It has been years, and we are still blocking a couple
of Hybris-A's a day.

Mike

>Cheers
>Tony
>_______________________________________________
>MIMEDefang mailing list
>MIMEDefang at lists.roaringpenguin.com
>http://lists.roaringpenguin.com/mailman/listinfo/mimedefang

--
Michael Sofka                          sofkam at rpi.edu
CCT Sr. Systems Programmer  email, webmail, listproc, TeX, epistemology.
Rensselaer Polytechnic Institute, Troy, NY.    http://www.rpi.edu/~sofkam/




More information about the MIMEDefang mailing list